File name:

Walliant.zip

Full analysis: https://app.any.run/tasks/1fa67167-2ac3-46af-a987-a9bd5e723857
Verdict: Malicious activity
Analysis date: August 03, 2024, 02:02:35
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

33968A33F7E098D31920C07E56C66DE2

SHA1:

9C684A0DADAE9F940DD40D8D037FAA6ADDF22DDB

SHA256:

6364269DBDC73D638756C2078ECB1A39296DDD12B384D05121045F95D357D504

SSDEEP:

98304:QXEXw3QBAg+V40y49wQ2pFQ0xxYtroaNrZaYzu9:kEA3AAg+Vt9V81xxYtfNLO

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • ska2pwej.aeh.exe (PID: 6640)
      • ska2pwej.aeh.tmp (PID: 6660)

    • Changes the autorun value in the registry

      • ska2pwej.aeh.tmp (PID: 6660)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 6488)
      • walliant.exe (PID: 5880)

    • Executable content was dropped or overwritten

      • ska2pwej.aeh.exe (PID: 6640)
      • ska2pwej.aeh.tmp (PID: 6660)

    • Reads the Windows owner or organization settings

      • ska2pwej.aeh.tmp (PID: 6660)

    • Checks Windows Trust Settings

      • walliant.exe (PID: 5880)

    • Process drops legitimate windows executable

      • ska2pwej.aeh.tmp (PID: 6660)

    • Reads Microsoft Outlook installation path

      • walliant.exe (PID: 5880)

    • Reads Internet Explorer settings

      • walliant.exe (PID: 5880)

  • INFO

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 6488)

    • Checks supported languages

      • ska2pwej.aeh.exe (PID: 6640)
      • ska2pwej.aeh.tmp (PID: 6660)
      • walliant.exe (PID: 5880)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 6488)

    • Create files in a temporary directory

      • ska2pwej.aeh.exe (PID: 6640)
      • ska2pwej.aeh.tmp (PID: 6660)

    • Reads the computer name

      • ska2pwej.aeh.tmp (PID: 6660)
      • walliant.exe (PID: 5880)

    • Reads the machine GUID from the registry

      • ska2pwej.aeh.tmp (PID: 6660)
      • walliant.exe (PID: 5880)

    • Reads the software policy settings

      • ska2pwej.aeh.tmp (PID: 6660)
      • walliant.exe (PID: 5880)

    • Creates files or folders in the user directory

      • ska2pwej.aeh.tmp (PID: 6660)
      • walliant.exe (PID: 5880)

    • Reads Environment values

      • walliant.exe (PID: 5880)

    • Checks proxy server information

      • walliant.exe (PID: 5880)

    • Disables trace logs

      • walliant.exe (PID: 5880)

    • Creates a software uninstall entry

      • ska2pwej.aeh.tmp (PID: 6660)

    • Process checks Internet Explorer phishing filters

      • walliant.exe (PID: 5880)

    • Manual execution by a user

      • Taskmgr.exe (PID: 6732)
      • Taskmgr.exe (PID: 1236)

    • Reads security settings of Internet Explorer

      • Taskmgr.exe (PID: 1236)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0001
ZipCompression: Deflated
ZipModifyDate: 2022:06:23 18:56:34
ZipCRC: 0x4b786beb
ZipCompressedSize: 4747047
ZipUncompressedSize: 5293448
ZipFileName: ska2pwej.aeh.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
141
Monitored processes
6
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe ska2pwej.aeh.exe ska2pwej.aeh.tmp walliant.exe taskmgr.exe no specs taskmgr.exe

Process information

PID
CMD
Path
Indicators
Parent process
1236"C:\WINDOWS\system32\taskmgr.exe" /4C:\Windows\System32\Taskmgr.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Task Manager
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\taskmgr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\powrprof.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5880"C:\Users\admin\AppData\Local\Programs\Walliant\walliant.exe"C:\Users\admin\AppData\Local\Programs\Walliant\walliant.exe
ska2pwej.aeh.tmp
User:
admin
Company:
Walliant
Integrity Level:
MEDIUM
Description:
Walliant
Version:
1.0.1.2
Modules
Images
c:\users\admin\appdata\local\programs\walliant\walliant.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
6488"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\Desktop\Walliant.zipC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
6640"C:\Users\admin\AppData\Local\Temp\Rar$EXb6488.37650\ska2pwej.aeh.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXb6488.37650\ska2pwej.aeh.exe
WinRAR.exe
User:
admin
Company:
Walliant
Integrity Level:
MEDIUM
Description:
Walliant Setup
Exit code:
0
Version:
1.0.1.2
Modules
Images
c:\users\admin\appdata\local\temp\rar$exb6488.37650\ska2pwej.aeh.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
6660"C:\Users\admin\AppData\Local\Temp\is-L85RQ.tmp\ska2pwej.aeh.tmp" /SL5="$40274,4511977,830464,C:\Users\admin\AppData\Local\Temp\Rar$EXb6488.37650\ska2pwej.aeh.exe" C:\Users\admin\AppData\Local\Temp\is-L85RQ.tmp\ska2pwej.aeh.tmp
ska2pwej.aeh.exe
User:
admin
Company:
Walliant
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-l85rq.tmp\ska2pwej.aeh.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\comdlg32.dll
c:\windows\syswow64\msvcrt.dll
6732"C:\WINDOWS\system32\taskmgr.exe" /4C:\Windows\System32\Taskmgr.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Manager
Exit code:
3221226540
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\taskmgr.exe
c:\windows\system32\ntdll.dll
Total events
18 802
Read events
18 467
Write events
327
Delete events
8

Modification events

(PID) Process:(6488) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(6488) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(6488) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\GoogleChromeEnterpriseBundle64.zip
(PID) Process:(6488) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\Walliant.zip
(PID) Process:(6488) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(6488) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(6488) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(6488) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(6488) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(6488) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
19
Suspicious files
14
Text files
11
Unknown types
1

Dropped files

PID
Process
Filename
Type
6660ska2pwej.aeh.tmpC:\Users\admin\AppData\Local\Programs\Walliant\AsyncBridge.Net35.dllexecutable
MD5:35CBDBE6987B9951D3467DDA2F318F3C
SHA256:E4915F18FD6713EE84F27A06ED1F6F555CDBEBE1522792CF4B4961664550CF83
6640ska2pwej.aeh.exeC:\Users\admin\AppData\Local\Temp\is-L85RQ.tmp\ska2pwej.aeh.tmpexecutable
MD5:62E5DBC52010C304C82ADA0AC564EFF9
SHA256:BD54AD7A25594DC823572D9B23A3490FF6B8B1742A75E368D110421AB08909B2
6488WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb6488.37650\ska2pwej.aeh.exeexecutable
MD5:929335D847F8265C0A8648DD6D593605
SHA256:6613ACB18CB8BF501FBA619F04F8298E5E633CB220C450212BBC9DD2BEF9538D
6660ska2pwej.aeh.tmpC:\Users\admin\AppData\Local\Programs\Walliant\walliant.exeexecutable
MD5:60D3737A1F84758238483D865A3056DC
SHA256:3436C29DEC2C7F633F4766ACAF334F6C395D70EA6180C0EA7C1610591D5D89B9
6660ska2pwej.aeh.tmpC:\Users\admin\AppData\Local\Programs\Walliant\is-DNN81.tmpexecutable
MD5:35CBDBE6987B9951D3467DDA2F318F3C
SHA256:E4915F18FD6713EE84F27A06ED1F6F555CDBEBE1522792CF4B4961664550CF83
6660ska2pwej.aeh.tmpC:\Users\admin\AppData\Local\Programs\Walliant\is-71RKK.tmpexecutable
MD5:62E5DBC52010C304C82ADA0AC564EFF9
SHA256:BD54AD7A25594DC823572D9B23A3490FF6B8B1742A75E368D110421AB08909B2
6660ska2pwej.aeh.tmpC:\Users\admin\AppData\Local\Programs\Walliant\is-2A30A.tmpexecutable
MD5:60D3737A1F84758238483D865A3056DC
SHA256:3436C29DEC2C7F633F4766ACAF334F6C395D70EA6180C0EA7C1610591D5D89B9
6660ska2pwej.aeh.tmpC:\Users\admin\AppData\Local\Temp\is-CTLB4.tmp\_isetup\_setup64.tmpexecutable
MD5:E4211D6D009757C078A9FAC7FF4F03D4
SHA256:388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
6660ska2pwej.aeh.tmpC:\Users\admin\AppData\Local\Programs\Walliant\SharpRaven.dllexecutable
MD5:C1A31AB7394444FD8AA2E8FE3C7C5094
SHA256:64B7231EDA298844697D38DD3539BD97FE995D88AE0C5E0C09D63A908F7336C4
6660ska2pwej.aeh.tmpC:\Users\admin\AppData\Local\Programs\Walliant\Newtonsoft.Json.dllexecutable
MD5:283544D7F0173E6B5BFBFBC23D1C2FB0
SHA256:9165E595B3A0DE91AC91A38E742597E12EBB2A5A8FA53058D964A06CEAEF7735
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
46
DNS requests
22
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
1536
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1536
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7080
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
5880
walliant.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW%2BVUAg%3D
unknown
—
—
whitelisted
7028
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
5880
walliant.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEA25Jn8PQ4RPLcbWdkE5MWs%3D
unknown
—
—
whitelisted
5880
walliant.exe
GET
200
2.16.241.12:80
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl
unknown
—
—
whitelisted
5880
walliant.exe
GET
200
2.16.241.12:80
http://crl.microsoft.com/pki/crl/products/CodeSigPCA.crl
unknown
—
—
whitelisted
5880
walliant.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAewQY2lHhSMMxu83rcTgyM%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3164
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
2120
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4056
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6660
ska2pwej.aeh.tmp
172.67.189.175:443
stats.walliant.com
CLOUDFLARENET
US
unknown
5336
SearchApp.exe
104.126.37.145:443
www.bing.com
Akamai International B.V.
DE
unknown
5336
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
1536
svchost.exe
20.190.159.68:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 51.124.78.146
whitelisted
google.com
  • 142.250.184.238
whitelisted
stats.walliant.com
  • 172.67.189.175
  • 104.21.57.77
unknown
www.bing.com
  • 104.126.37.145
  • 104.126.37.131
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 20.190.159.68
  • 20.190.159.73
  • 20.190.159.4
  • 20.190.159.2
  • 40.126.31.71
  • 20.190.159.75
  • 20.190.159.23
  • 20.190.159.64
whitelisted
th.bing.com
  • 104.126.37.131
  • 104.126.37.145
whitelisted
client.wns.windows.com
  • 40.113.110.67
whitelisted
fd.api.iris.microsoft.com
  • 20.199.58.43
whitelisted
arc.msn.com
  • 20.103.156.88
  • 20.223.35.26
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Walliant.zip